qa-supertest-writer
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is designed for automated test generation and incorporates strong security guidance. It explicitly instructs against hardcoding secrets and provides templates for using environment variables and test fixtures for authentication.
- [INDIRECT_PROMPT_INJECTION]: The skill has a potential attack surface as it ingests untrusted external data (OpenAPI contracts and test case specifications) to generate code.
- Ingestion points: The skill reads data from test case specifications and OpenAPI contracts (potentially provided via dependencies like qa-api-contract-curator).
- Boundary markers: No specific delimiters or "ignore" instructions are defined to separate contract data from agent instructions.
- Capability inventory: The skill is capable of writing generated TypeScript code to the file system (tests/api).
- Sanitization: Input data from contracts is not explicitly sanitized before being used in code templates.
- Risk Mitigation: The risk is mitigated by the fact that the skill generates code but does not execute it, and it includes a quality checklist for human review.
Audit Metadata